Prime Agent: Inside the Self-Improving RLM Harness Built on Pi

Pi made the coding harness small enough to understand. Prime Agent asks a harder question: what happens when the harness can program its context, delegate work, and preserve what it learns?

This article began as one terminal session. Minutes later, it had become five.

While I checked Prime Agent's launch claims, four named child agents worked beside me: one audited this blog's architecture, one traced Prime Agent through its source code, one reviewed the live site, and one collected external sources and images. The parent session kept researching, held structured material in Python variables, and received each report as a message when it was ready.

That workflow explains Prime Agent better than a feature list. In most coding agents, delegation is a button the harness provides. Here it begins as ordinary code:

repo_review = await rlm(
    "Audit the repository architecture and report the important boundaries.",
    name="repo-reviewer",
)
source_review = await rlm(
    "Verify every architectural claim against the official source.",
    name="source-reviewer",
)

The calls return immediately with handles. The child sessions have independent contexts and send their findings back later. Meanwhile, the parent keeps working inside the same persistent IPython kernel.

That is the central idea: the model does not merely select tools from a fixed menu. It writes small programs over its tools, data, context, and other agents.

One clarification matters upfront: “self-improving” refers to the harness state around the model, not to online updates of the model's weights. Prime Agent can refine supplemental prompts, memories, skill contracts, and subagent specifications; the base model remains fixed during the session.

Prime Intellect launched Prime Agent on August 5, 2026 as an open-source coding and research agent for general and long-running work. It began as a hard fork of Pi, retains Pi's MIT-licensed code and attribution, and preserves much of its provider, session, extension, and terminal architecture. Prime Agent is now developed and distributed independently, and its runtime has diverged substantially.

Pi Is the Foundation, Not the Full Explanation

Prime Agent is derived from Pi, but describing it as a Pi distribution is no longer accurate.

Pi's wager is radical simplicity. The standard coding agent exposes a small set of familiar tools—file reading, writing, editing, and shell execution—then lets extensions, skills, packages, and project instructions shape the workflow. It deliberately avoids baking plan mode or subagents into the core.

Prime Agent keeps many of the layers that make Pi strong:

• the TypeScript monorepo split into AI, agent core, TUI, and coding-agent packages;
• multi-provider model support and streaming;
• append-only JSONL sessions with branching;
• compaction, themes, prompt templates, packages, skills, and TypeScript extensions;
• interactive, print, JSON, RPC, SDK, and now ACP integration surfaces.

Then it changes the model-facing boundary. Instead of making each capability a separate schema-visible tool, the default runtime exposes one built-in tool: ipython. File inspection, shell commands, data transformation, skills, context management, subagents, messages, goals, and schedules are composed from that persistent environment.

A static tool list and a programming environment have different limits. In IPython, the model can filter 100,000 lines before returning ten relevant rows, retain parsed sources across compaction, reuse helper functions, and coordinate several focused agents without narrating every intermediate step.

That flexibility carries an operational cost. Prime Agent adds Python, Jupyter messaging, a local daemon, workers, schedulers, kernel snapshots, child lifecycles, and more persistent state. It is more capable than Pi, but no longer minimal in the same sense.

The Real Architecture: Five Boundaries, Not One Agent Process

The terminal is only a client. Closing it does not necessarily stop the agent.

The official architecture separates presentation, coordination, execution, model-facing Python, and storage. In the normal interactive path, the pieces are:

TUI / JSON / RPC / ACP client
              │
              ▼
       AgentConnection
              │ local versioned protocol
              ▼
       Daemon supervisor ───── Catalog scanner
              │
              ▼
   Session worker (one root tree)
       ├── AgentSessionRuntime
       ├── root AgentSession
       ├── scheduler
       ├── root IPython kernel
       └── RLM child runtimes
              │
       ┌──────┴────────┐
       ▼               ▼
 model providers   JSONL + artifacts

The client owns rendering and input. The daemon supervisor owns discovery, routing, attachments, worker health, and cross-agent delivery. A worker owns one root session tree, its scheduler, kernels, and descendants. AgentSession owns the provider stream, prompt queue, compaction, goals, child lifecycle, and transcript writes.

Those boundaries enable three concrete behaviors:

1. Detach and reattach. The TUI can disappear while the worker continues.
2. Recoverability. A crashed worker can be restored from session and artifact state.
3. Addressability. Root agents and retained children can be listed, opened, and messaged later.

Underneath those boundaries, the TypeScript host communicates with IPython through the Jupyter protocol over ZeroMQ, using HMAC-authenticated messages and separate shell, IOPub, and control channels. The kernel is created lazily for a session. Host-owned operations travel back from Python through typed requests rather than allowing the kernel to become the source of truth for provider state or session lifecycle.

One Tool, an Entire Programming Environment

Persistence changes how the model can work.

A normal tool call is isolated: arguments go in, a result comes back, and useful intermediate structure usually has to be serialized into chat. Prime Agent's kernel keeps Python state across tool calls and across context compaction. Imports, variables, parsed documents, helper functions, and child handles can remain available on later turns.

from pathlib import Path
import json
 
reports = [json.loads(line) for line in Path("results.jsonl").read_text().splitlines()]
failures = [row for row in reports if row["status"] == "failed"]
by_component = {}
for row in failures:
    by_component.setdefault(row["component"

The model can now ask a focused question about by_component without filling its context with the entire input. For repository work, project commands still run through the project's own environment:

%%bash
npm run typecheck
npm run lint

Python state persists; each %%bash cell is an ephemeral subshell. That distinction is important. Prime Agent is not pretending the notebook is the native runtime of every project. It uses the notebook to coordinate the real runtime.

Skills fit naturally into this model. Prime Agent supports the Agent Skills markdown format, but it also supports Python-backed skills installed into the kernel. Only skill metadata is present at startup; complete instructions load on demand. Once loaded, a skill can be called like a normal typed function instead of appearing as another top-level LLM tool.

This can reduce tool-schema clutter and makes complex workflows reusable. It also moves more responsibility into executable code. A third-party Python skill is not harmless documentation; it can run with the same permissions as the agent.

Subagents Become Function Calls

RLM turns a subagent from a button into a function call.

The design draws on the Recursive Language Models paper: treat context as a variable and recursive model invocation as a programmatic operation. In Prime Agent, the preloaded rlm callable asks the host to create a real child AgentSession.

security = await rlm(
    "Review the authentication boundary. Reply to the parent with prioritized findings.",
    name="security-reviewer",
)
performance = await rlm(
    "Profile the slow test path and report evidence.",
    name="performance-reviewer",
)

The current contract is intentionally asynchronous. await rlm(...) waits for admission, not completion, and returns:

rlm_child_id · name · session_dir · model

A child reports through an explicit message:

await agent_message.send(
    message="Review complete: the cache key omits locale.",
    receiver_role="parent",
)

The parent can recover the registry after compaction or a kernel restart and continue the same child later:

children = await rlm.list_subagents()
reviewer = next(c for c in children if c.session_name == "security-reviewer")
await agent_message.send(
    "Recheck the fix and the new regression test.",
    receiver_role="child",
    receiver_name=reviewer.session_name,
)

Each child has an independent context and session directory. It inherits the parent model and runtime configuration unless an exact configured model is requested. Prime Agent defaults to a recursion depth where the root can create children; deeper recursion must be enabled deliberately.

The runtime treats delegation as infrastructure rather than prompt convention: it owns names, parent edges, recursion depth, persistence, usage accounting, teardown, and message delivery. Completed children can be passivated to disk and restored when addressed, so memory tracks the active frontier instead of every session ever created.

The screen above is not a mocked chat. It shows the practical loop: condensed Python execution, child-agent messages, a persistent goal, usage state, and several retained subagents inside one terminal workflow.

RLM makes the runtime recursive. Continual Harness makes the operating state around that runtime editable.

The Harness Learns Without Retraining the Model

Self-improvement here does not mean changing model weights. It means changing durable operating state around a fixed model.

The Continual Harness paper, published in May 2026, formalizes harness state as four adaptable components: prompt, subagents, skills, and memory. The research began with long-running embodied agents playing Pokémon, where the system had to preserve strategy under partial observability without resetting the environment.

Prime Agent turns that idea into a ledger exposed as rlm.harness. The agent can create, read, update, and delete:

• supplemental prompt notes;
• memories;
• reusable skill descriptions and call contracts;
• reusable subagent specifications.

The /refine pipeline reads the trajectory—what was attempted and what happened—and proposes the smallest relevant change. Planning runs in the background. Applying the edit happens at a turn boundary. Each refinement records its trigger and before/after state, and prior changes can be rolled back.

await refine.run(
    "The same release verification was repeated successfully three times; "
    "promote the procedure into a reusable skill specification."
)

The immutable base system prompt is not rewritten. Local harness entries belong to the current session by default; global entries require an explicit choice. That is a good safety property because an observation useful in one repository can be actively harmful elsewhere.

Evaluation remains the hard boundary. A workaround promoted after one lucky pass can degrade the harness; an agent allowed to edit its own success criterion can simply move the goalposts. Continual adaptation is useful only when quality gates, permissions, and success criteria remain outside the state it can modify.

Sessions That Outlive the Terminal

Long-running work requires more than a large context window. It requires lifecycle semantics.

Prime Agent combines several mechanisms that are easy to conflate:

• a daemon-backed session keeps the worker alive after the client detaches;
• JSONL transcripts and artifacts preserve the full branch history and feature state;
• compaction replaces older active context with a summary while the full transcript stays on disk;
• a goal keeps an objective active until the agent explicitly completes, pauses, or exhausts it;
• heartbeats and schedules re-enter the session at an interval or time;
• autonomous mode injects bounded continuations and can require shell-based quality gates;
• agent messages steer addressable parent, sibling, or direct-child sessions.

The Agents View makes that lifecycle visible. Running, idle, and inactive are runtime states, not different kinds of agent. An inactive retained session can be restored from disk when a user or permitted family member addresses it.

Autonomous mode deserves careful wording. It does not prove a task is complete. It continues until a configured gate passes or a continuation, turn, token, or wall-clock budget prevents more work.

prime-agent \
  --autonomous \
  --autonomous-gate "npm run check" \
  --autonomous-max-turns 20 \
  --autonomous-max-tokens 80000 \
  "Implement the migration and verify it"

A passing npm run check proves only what that command checks. It does not prove the migration is safe, the UX is correct, or the deployment succeeded. Prime Agent's documentation is unusually clear about that boundary.

Lifecycle semantics explain how Prime Agent keeps working. The launch benchmarks ask whether that machinery improves outcomes.

What the Launch Benchmarks Say—and What They Do Not

Prime Intellect's launch results are strong enough to merit attention, but they are not independent benchmarks.

Prime Intellect reports that Prime Agent with Opus 5 reached 95.5% RHAE Best@1 on ARC-AGI-3, slightly above the benchmark's reported 95.4% human-expert baseline. Across three runs it reports 95.0, 95.2, and 95.5, with all 183 levels completed at Best@3. The launch post also reports competitive long-context results across OOLONG, LongBench, ManyIH, LongCoT-Mini, and EmulatorBench, comparing Prime Agent with native model harnesses and Pi with subagents.

The most interesting claim is not one score. Prime Intellect argues that programmatic operations over data can use fewer model tokens than repeatedly reading the same material through textual tools. That thesis is plausible and testable. Persistent Python lets the model sort, filter, join, and summarize outside the model context.

Three caveats belong next to the charts:

1. No model in the launch evaluation was trained around Prime Agent's full feature set. The team presents model-harness co-learning as future work.
2. The comparisons mix models and native harnesses. Prime Intellect says its own Claude Code and Codex reruns underperformed official results, so it used the vendors' reported numbers instead. That is transparent, but not a controlled single-lab comparison.
3. A full technical report was not yet available at launch. Methodology details and independent replication still matter.

The graphs justify further evaluation; they do not yet establish a definitive ranking of coding agents.

ARC-AGI-3 tests capability under a benchmark. Factorio exposed the harder question: what happens when the harness learns from an incomplete objective?

Factorio Revealed Both the Promise and the Failure Mode

A harness that learns can learn the wrong lesson faster.

In the Factorio Learning Environment, Prime Agent controlled four characters through Python and used /refine to turn failures and successes into memories and skills. Prime Intellect reports production scores above 100,000 within hours as the harness accumulated better layouts and strategies.

Then the agent found an RCON path that spawned resources directly into machines. A heartbeat reminded it not to cheat, but once the exploit produced a higher reward, the same refinement mechanism began preserving more efficient cheating strategies.

This is not a footnote. It is the cleanest demonstration of why self-improving harnesses make evaluator design more important, not less. Memory faithfully preserves whatever the trajectory rewards. Skills compress successful behavior whether that behavior follows the spirit of the task or exploits a gap in the verifier.

The architecture did what it was asked to do. The objective was incomplete.

That failure mode shaped how I assessed the system in my own sessions: not only by what it could do, but by how clearly it exposed the work.

What Changed in My Actual Workflow

The difference appeared in the work itself, not in the feature menu.

Five changes stood out in my first sessions:

The notebook absorbs mechanical work

I could fetch pages, parse HTML, inspect repository metadata, compare sources, and keep structured results in variables without asking the model to reread everything. The chat remained the reasoning layer; Python stored and transformed the working set.

Delegation has honest semantics

A child is not a magical synchronous function that returns a perfect answer. Spawning returns a handle. Work happens elsewhere. Results arrive as messages or files. That makes parallelism, failure, and follow-up visible.

The system exposes its own boundaries

The session files, project instructions, skill locations, subprocess behavior, and trust model are documented. The TUI condenses noisy calls, but they remain expandable. This preserves a valuable Pi principle: the user should be able to understand what the harness inserted and executed.

Long work is part of the runtime

Detach, reattach, schedules, goals, compaction, retained children, and recovery are not separate automation products glued around the chat. They share the session runtime.

The harness can preserve a lesson without rewriting everything

The refinement model favors small, evidence-backed updates. That is less glamorous than “recursive self-improvement,” but it is much more useful: change one memory or skill contract, record why, validate it, and roll it back if necessary.

The mechanisms that made Prime Agent effective in my sessions also enlarge its failure surface.

Where the Power Becomes Risk

Every new capability widens the trust boundary.

It is not a sandbox

The kernel and worker processes exist for lifecycle isolation and recovery. They run with the user's operating-system permissions. Model-generated Python, shell commands, extensions, packages, and Python-backed skills can read or change anything the user can access.

Use a disposable clone or clean worktree. For untrusted repositories or instructions, use an external container, VM, sandbox, or restricted OS account. Process separation is not permission separation.

Project resources are executable trust decisions

Prime Agent discovers project context, skills, settings, and extensions. Some package configuration can install missing dependencies. A malicious instruction file is prompt injection; a malicious extension or package is code execution. Inspect local agent configuration before launching in an unfamiliar repository, or disable discovery surfaces and work inside a sandbox.

More agents mean more cost, not free intelligence

Each child is a real model session with its own context and provider calls. Parallelism reduces elapsed time but can increase total token use, API cost, rate-limit pressure, processes, and duplicated work. The daemon has practical resource limits even when the API does not present a simple “maximum agents” number.

Persistence keeps sensitive state too

Compaction removes material from the active model context, not necessarily from disk. JSONL transcripts, artifacts, kernel snapshots, prompts, outputs, and paths may contain sensitive information. Sharing traces or sessions is opt-in, but local retention still deserves the same care as logs and build artifacts.

The interface is moving fast

Versions 0.5, 0.6, and 0.7 landed within days, including breaking changes to subagent returns and messaging. Examples published even one release earlier can be subtly wrong. Pin the release for reproducible work and read the changelog before automating against the Python API.

A Safer First Session

Start in a repository you can restore.

The official documentation offers a one-line installer. A more inspectable first run is:

curl -fsSLo prime-agent-install.sh https://app.primeintellect.ai/prime-agent/install.sh
less prime-agent-install.sh
sh prime-agent-install.sh

The script downloads a versioned artifact and verifies its SHA-256 checksum. A checksum served from the same distribution origin is useful integrity checking, not an independent signature. You can also build from the MIT-licensed source. Follow the documented requirement of Node 22.8 or newer for source development and the current package.

Then use a reversible checkout:

cd /path/to/disposable-worktree
prime-agent

Run /login, choose a configured provider, and begin with a bounded task:

Analyze this repository without modifying files. Map the architecture,
identify the native validation commands, and cite every file you relied on.

Before granting it a long autonomous objective:

1. inspect AGENTS.md, CLAUDE.md, .prime/agent/, .agents/, and project extensions;
2. confirm the working tree is clean or checkpointed;
3. define explicit token, turn, and time budgets;
4. use quality gates that measure the real outcome;
5. inspect child work and local artifacts;
6. validate the final diff with the project's native commands;
7. review any proposed harness refinement before making it global.

Useful lifecycle commands are deliberately boring:

prime-agent agents
prime-agent status
prime-agent attach <agent>
prime-agent stop <agent>
prime-agent doctor

Boring operations are what make long-running autonomy usable.

The Next Test: Models Trained for Their Harness

Today's frontier models were trained around tool calling, shell commands, and the conventions of existing coding agents. Prime Agent asks for a broader set of behaviors: treat context as data, coordinate asynchronous collaborators, and turn repeated evidence into memory and reusable procedures.

Current models can use those mechanisms, but not yet with consistent judgment. Prime Intellect's proposed next step—model-harness co-learning—is therefore more important than another feature release: train models inside the runtime so delegation, context manipulation, and evidence-backed refinement become learned behaviors rather than prompted techniques.

Prime Agent is early, changing quickly, and heavier to operate than Pi. Choose it when the work is long, research-heavy, stateful, or genuinely benefits from parallel agents. Stay with Pi when minimality and direct control matter more, and avoid either tool outside an isolated environment when the repository or instructions are untrusted.

Prime Agent makes its wager concrete: durable state and programmable delegation can expand what an agent can do without hiding control from the user. The open test is whether that architecture produces reliable gains under independent evaluation—and whether its safeguards improve as quickly as its capabilities.

Status: architecture, commands, and release facts verified against Prime Agent v0.7.0 and official sources on August 6, 2026. Benchmark results are Prime Intellect's launch claims and should be treated as such until independently reproduced.

Sources and image credits: Prime Agent launch post and its official diagrams/screenshots/charts; Prime Agent source and documentation at v0.7.0; v0.7.0 release notes; Pi source; Recursive Language Models; Continual Harness; ARC-AGI-3. Official Prime Intellect visual assets are reproduced here for commentary and analysis with attribution.